{
  "schema_version": "1.4.0",
  "id": "GHSA-w3pj-wh35-fq8w",
  "modified": "2025-02-05T15:32:03Z",
  "published": "2025-02-05T15:32:02Z",
  "aliases": [
    "CVE-2024-36404"
  ],
  "summary": "GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions",
  "details": "### Summary\nRemote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input.\n\n### Details\nThe following methods pass XPath expressions to the `commons-jxpath` library which can execute arbitrary code and would be a security issue if the XPath expressions are provided by user input.\n\n* `org.geotools.appschema.util.XmlXpathUtilites.getXPathValues(NamespaceSupport, String, Document)`\n* `org.geotools.appschema.util.XmlXpathUtilites.countXPathNodes(NamespaceSupport, String, Document)`\n* `org.geotools.appschema.util.XmlXpathUtilites.getSingleXPathValue(NamespaceSupport, String, Document)`\n* `org.geotools.data.complex.expression.FeaturePropertyAccessorFactory.FeaturePropertyAccessor.get(Object, String, Class<T>)`\n* `org.geotools.data.complex.expression.FeaturePropertyAccessorFactory.FeaturePropertyAccessor.set(Object, String, Object, Class)`\n* `org.geotools.data.complex.expression.MapPropertyAccessorFactory.new PropertyAccessor() {...}.get(Object, String, Class<T>)`\n* `org.geotools.xsd.StreamingParser.StreamingParser(Configuration, InputStream, String)`\n\n### PoC\nThe following inputs to StreamingParser will delay the response by five seconds:\n```\n        new org.geotools.xsd.StreamingParser(\n                        new org.geotools.filter.v1_0.OGCConfiguration(),\n                        new java.io.ByteArrayInputStream(\"<Filter></Filter>\".getBytes()),\n                        \"java.lang.Thread.sleep(5000)\")\n                .parse();\n```\n\n### Impact\n\nThis vulnerability can lead to executing arbitrary code.\n\n### Mitigation\n\nGeoTools can operate with reduced functionality by removing the `gt-complex` jar from your application.  As an example of the impact application schema datastore would not function without the ability to use XPath expressions to query complex content.\n\nThe SourceForge download page lists drop-in-replacement jars for GeoTools: [31.1](https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1/), [30.3](https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download), [30.2](https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download), [29.2](https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download), [28.2](https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download), [27.5](https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download), [27.4](https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download), [26.7](https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download), [26.4](https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4/), [25.2](https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download), [24.0](https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download). These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.\n\n### References\nhttps://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv\nhttps://osgeo-org.atlassian.net/browse/GEOT-7587\nhttps://github.com/geotools/geotools/pull/4797\nhttps://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-app-schema"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "30.0"
            },
            {
              "fixed": "30.4"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-complex"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "30.0"
            },
            {
              "fixed": "30.4"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools.xsd:gt-xsd-core"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "30.0"
            },
            {
              "fixed": "30.4"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-app-schema"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "31.0"
            },
            {
              "fixed": "31.2"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-complex"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "31.0"
            },
            {
              "fixed": "31.2"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools.xsd:gt-xsd-core"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "31.0"
            },
            {
              "fixed": "31.2"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-app-schema"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "29.0"
            },
            {
              "fixed": "29.6"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-complex"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "29.0"
            },
            {
              "fixed": "29.6"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools.xsd:gt-xsd-core"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "29.0"
            },
            {
              "fixed": "29.6"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-app-schema"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "28.6"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools:gt-complex"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "28.6"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.geotools.xsd:gt-xsd-core"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "28.6"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36404"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geotools/geotools/pull/4797"
    },
    {
      "type": "WEB",
      "url": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download"
    },
    {
      "type": "WEB",
      "url": "https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download"
    },
    {
      "type": "WEB",
      "url": "https://osgeo-org.atlassian.net/browse/GEOT-7587"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/geotools/geotools"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-95"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2025-02-05T15:32:02Z",
    "nvd_published_at": "2024-07-02T14:15:13Z"
  }
}